||Home : Advisories : BS Scripts Multiple CGI Vulnerabilities|
||BS Scripts Multiple CGI Vulnerabilities
||21st December 2000
BS Scripts Multiple CGI Vulnerabilities
Discovered by Elf (firstname.lastname@example.org)
Greetz: 0x7f, CompSci, Dugnet
There are a couple of scripts from bsScripts
(www.stanback.net) , that have holes in them
because the author did not filter out ; from the form
input. The scripts that this affects is bsguest (a
guestbook script) and bslist (a mailing list script).
The hole allows anyone to execute commands on the
server. The author has been informed and the holes
are now patched in the latest release.
BSGuest does not filter out ; resulting in the ability for
anyone to execute commands on the server. The
attacker just enters his email address
email@example.com < /etc/passwd', and then the
server mails a confirmation letter along with the
passwd file to the attacker.
BSList also doesn't filter out the ; and once again
anybody can execute commands on the server. This
can be exploited by signing up for the mailing list with
the email address of
firstname.lastname@example.org < /etc/passwd'
"It's funny how impossible dreams manifest" -